registry / superlocalmemory / 3.8.14

superlocalmemory@3.8.14

Local-first agent memory with MCP and an agent-native CLI. Documented clients include Claude Code, Cursor, and Windsurf.

Static Scan Results

scanned 17d ago · by rust-scanner

Static analysis flagged 19 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

CopyleftLicense

scanned 70 file(s), 1.70 MB of source, external domains: api.anthropic.com, api.openai.com, github.com, openrouter.ai, popper.js.org, pypi.org, qualixar.com, superlocalmemory.com, varunpratap.com, www.npmjs.com, www.python.org, www.w3.org

Source & flagged code

10 flagged

package.jsonView file

Lines 34-74json

34 "license": "AGPL-3.0-or-later",

35 "repository": {

36 "type": "git",

37 "url": "https://github.com/qualixar/superlocalmemory.git"

38 },

39 "homepage": "https://superlocalmemory.com",

40 "mcpName": "io.github.qualixar/superlocalmemory",

41 "bugs": {

42 "url": "https://github.com/qualixar/superlocalmemory/issues"

43 },

44 "bin": {

45 "slm": "./bin/slm-npm",

46 "superlocalmemory": "./bin/slm-npm"

47 },

48 "scripts": {

49 "build:plugin": "node scripts/build-plugin.mjs",

50 "check:plugin": "node scripts/build-plugin.mjs --check",

51 "build:copilot-plugin": "node scripts/build-copilot-plugin.mjs",

52 "check:copilot-plugin": "node scripts/build-copilot-plugin.mjs --check",

53 "prepack": "node scripts/build-plugin.mjs && node scripts/build-copilot-plugin.mjs && node scripts/prepack.js",

54 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L54

55 "preuninstall": "node scripts/preuninstall.js",

56 "test": "node scripts/run-ui-tests.mjs"

57 },

58 "engines": {

59 "node": ">=18.0.0",

60 "npm": ">=9.0.0"

61 },

62 "os": [

63 "darwin",

64 "linux",

65 "win32"

66 ],

67 "files": [

68 "bin/slm-npm",

69 "src/superlocalmemory/",

70 "!src/**/__pycache__/",

71 "!src/**/*.pyc",

72 "!src/**/*.pyo",

73 "ide/completions/",

74 "ide/configs/",

src/superlocalmemory/ui/vendor/d3.v7.min.jsView file

Lines 1-3javascript

2!function(t,n){"object"==typeof exports&&"undefined"!=typeof module?n(exports):"function"==typeof define&&

ide/hooks/memory-profile-skill.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * Memory Profile CLI Skill (V3)

4 * Provides memory-profile commands for managing multiple memory contexts

5 */

7const { execFile } = require('child_process');

8const {

ide/completions/slm.zshView file

•path = ide/completions/slm.zsh kind = build_helper sizeBytes = 1964 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

ide/completions/slm.zshView on unpkg

ide/hooks/memory-list-skill.jsView file

•matchType = normalized_sha256 matchedPackage = superlocalmemory@3.6.23 matchedPath = ide/hooks/memory-list-skill.js matchedIdentity = npm:c3VwZXJsb2NhbG1lbW9yeQ:3.6.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

ide/hooks/memory-list-skill.jsView on unpkg

ide/hooks/memory-recall-skill.jsView file

•matchType = normalized_sha256 matchedPackage = superlocalmemory@3.6.23 matchedPath = ide/hooks/memory-recall-skill.js matchedIdentity = npm:c3VwZXJsb2NhbG1lbW9yeQ:3.6.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

ide/hooks/memory-recall-skill.jsView on unpkg

ide/hooks/memory-remember-skill.jsView file

•matchType = normalized_sha256 matchedPackage = superlocalmemory@3.6.23 matchedPath = ide/hooks/memory-remember-skill.js matchedIdentity = npm:c3VwZXJsb2NhbG1lbW9yeQ:3.6.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

ide/hooks/memory-remember-skill.jsView on unpkg

ide/hooks/memory-reset-skill.jsView file

•matchType = normalized_sha256 matchedPackage = superlocalmemory@3.6.23 matchedPath = ide/hooks/memory-reset-skill.js matchedIdentity = npm:c3VwZXJsb2NhbG1lbW9yeQ:3.6.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

ide/hooks/memory-reset-skill.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.json

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code